I read the following blog post about implementing custom user log in:
In the post, the author walks through some PHP code for logging in a user via a form while checking a nonce.
My understanding is that nonces are used to prevent CSRF attacks -- that is, to prevent logged in users from being tricked into taking some action without realizing it. But if the user is not logged in... Is the nonce accomplishing anything?
Do all non-logged-in users get the same nonce? I can't think of how else they would be implemented. I guess a nonce could be useful if some imporant action is taken as a direct result of logging in... but if all guests visiting the login form get the same nonce, then a CSRF attack would still be trivial to execute, wouldn't it?
I'm still learning about security stuff, and am finding this quite confusing.